Bayes' Theorem

A detector that catches 97.5% of attacks and wrongly flags only 1% of benign prompts can be wrong about nine flags in ten. Those are the published numbers of Llama Prompt Guard 2, the pair of small classifiers Meta released in April 2025 to flag prompt-injection and jailbreak attempts before they reach a language model. Its model card reports that the 86-million-parameter version catches 97.5% of attacks on an English benchmark built from data distinct from its training set, at a threshold where it wrongly flags 1% of benign prompts. Put it in front of an assistant that serves 10 million requests a day, suppose one request in a thousand is an attack, and on its first day it flags 109,650 requests, of which 99,900 come from ordinary users. The model card is still accurate.